{"action":"closed","issue":{"url":"https://api.github.com/repos/blawrencenstest/CircleCIIntegration/issues/81","repository_url":"https://api.github.com/repos/blawrencenstest/CircleCIIntegration","labels_url":"https://api.github.com/repos/blawrencenstest/CircleCIIntegration/issues/81/labels{/name}","comments_url":"https://api.github.com/repos/blawrencenstest/CircleCIIntegration/issues/81/comments","events_url":"https://api.github.com/repos/blawrencenstest/CircleCIIntegration/issues/81/events","html_url":"https://github.com/blawrencenstest/CircleCIIntegration/issues/81","id":231637197,"number":81,"title":"Lab Automated static analysis: Keysize Check","user":{"login":"blawrencenstest","id":26233934,"avatar_url":"https://avatars1.githubusercontent.com/u/26233934?v=3","gravatar_id":"","url":"https://api.github.com/users/blawrencenstest","html_url":"https://github.com/blawrencenstest","followers_url":"https://api.github.com/users/blawrencenstest/followers","following_url":"https://api.github.com/users/blawrencenstest/following{/other_user}","gists_url":"https://api.github.com/users/blawrencenstest/gists{/gist_id}","starred_url":"https://api.github.com/users/blawrencenstest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blawrencenstest/subscriptions","organizations_url":"https://api.github.com/users/blawrencenstest/orgs","repos_url":"https://api.github.com/users/blawrencenstest/repos","events_url":"https://api.github.com/users/blawrencenstest/events{/privacy}","received_events_url":"https://api.github.com/users/blawrencenstest/received_events","type":"User","site_admin":false},"labels":[{"id":565309092,"url":"https://api.github.com/repos/blawrencenstest/CircleCIIntegration/labels/lab-automated","name":"lab-automated","color":"0099FF","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-05-26T14:09:00Z","updated_at":"2017-06-21T14:53:33Z","closed_at":"2017-06-21T14:53:33Z","body":"### Summary\nPlatform: android\nPackage: bscorp.appbase\n\nThis test checks to see if the key used to sign the application is larger than 1024 bits. Anything smaller leaves your app vulnerable to forged digital signatures.\n\n### Risk and Regulatory information\nSeverity: medium\nCVSS: 5.9\n\nCWE: [310](https://cwe.mitre.org/data/definitions/310.html), [326](https://cwe.mitre.org/data/definitions/326.html)\nOWASP: [Mobile Top 10: M5-Insufficient Cryptography](https://www.owasp.org/index.php/Mobile_Top_10_2016-M5-Insufficient_Cryptography)\nNIAP: [FPT_TUD_EXT.1.6](https://www.niap-ccevs.org/pp/pp_app_v1.1_table-reqs.htm#FPT_TUD_EXT.1.6), [FCS_COP.1.1(3)](https://www.niap-ccevs.org/pp/pp_app_v1.1_table-reqs.htm#FCS_COP.1.1(3))\n\n### Details\nYour application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures.\n\n### Recommendation\nWe recommend signing your app using a key with a length of at least 2048 bits (preferably 4096 bits) to provide optimum protection against forged digital signatures. Keytool, used to sign Android applications as described here: http://developer.android.com/tools/publishing/app-signing.html, can be used with the parameter -keysize <size> to specify a longer key length than the 1024-bit default.\n\nView more details in Lab Automated: [https://lab.nowsecure.com/app/android/bscorp.appbase/assessment/1495807492346](https://lab.nowsecure.com/app/android/bscorp.appbase/assessment/1495807492346)"}}
{"actor":{"display_login":"blawrencenstest"}}